services:
  db:
    container_name: lean101-clients-db
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-lean101}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}
      POSTGRES_DB: ${POSTGRES_DB:-lean101}
    volumes:
      - clients_db_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-lean101} -d ${POSTGRES_DB:-lean101}"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 15s

  backend:
    container_name: lean101-clients-backend
    build:
      context: .
      dockerfile: backend/Dockerfile
    restart: unless-stopped
    environment:
      APP_NAME: ${APP_NAME:-Hunter App}
      APP_ENV: ${APP_ENV:-production}
      DATABASE_URL: ${DATABASE_URL:-postgresql+psycopg://${POSTGRES_USER:-lean101}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB:-lean101}}
      CLIENT_NAME: ${CLIENT_NAME:-Hunter Premium Produce}
      CLIENT_EMAIL: ${CLIENT_EMAIL:-operator@example.com}
      CLIENT_PASSWORD: ${CLIENT_PASSWORD:?CLIENT_PASSWORD is required}
      CLIENT_TENANT_ID: ${CLIENT_TENANT_ID:-hunter-premium-produce}
      ADMIN_NAME: ${ADMIN_NAME:-Lean 101}
      ADMIN_EMAIL: ${ADMIN_EMAIL:-admin@lean101.local}
      ADMIN_PASSWORD: ${ADMIN_PASSWORD:?ADMIN_PASSWORD is required}
      AUTH_SECRET: ${AUTH_SECRET:?AUTH_SECRET is required}
      CORS_ALLOW_ORIGINS: ${CORS_ALLOW_ORIGINS:-https://clients.lean-101.com.au}
      CORS_ALLOW_ORIGIN_REGEX: ${CORS_ALLOW_ORIGIN_REGEX:-}
      TRUSTED_HOSTS: ${TRUSTED_HOSTS:-clients.lean-101.com.au}
      SESSION_COOKIE_SECURE: ${SESSION_COOKIE_SECURE:-true}
      SESSION_COOKIE_SAMESITE: ${SESSION_COOKIE_SAMESITE:-lax}
      SESSION_COOKIE_DOMAIN: ${SESSION_COOKIE_DOMAIN:-}
      SESSION_TTL_SECONDS: ${SESSION_TTL_SECONDS:-43200}
      REQUEST_BODY_MAX_BYTES: ${REQUEST_BODY_MAX_BYTES:-1048576}
      LOGIN_RATE_LIMIT_ATTEMPTS: ${LOGIN_RATE_LIMIT_ATTEMPTS:-8}
      LOGIN_RATE_LIMIT_WINDOW_SECONDS: ${LOGIN_RATE_LIMIT_WINDOW_SECONDS:-300}
      DOCS_ENABLED: ${DOCS_ENABLED:-false}
      # Read-only Power BI data API (/api/v1). Blank disables it.
      POWERBI_API_KEY: ${POWERBI_API_KEY:-}
      POWERBI_TENANT_ID: ${POWERBI_TENANT_ID:-${CLIENT_TENANT_ID:-hunter-premium-produce}}
    depends_on:
      db:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/health')"]
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 25s

  frontend:
    container_name: lean101-clients-frontend
    build:
      context: .
      dockerfile: frontend/Dockerfile
    restart: unless-stopped
    environment:
      ORIGIN: ${ORIGIN:-https://clients.lean-101.com.au}
      PORT: 3000
      HOST: 0.0.0.0
      PUBLIC_API_BASE_URL: ${PUBLIC_API_BASE_URL:-https://clients.lean-101.com.au}
      INTERNAL_API_BASE_URL: ${INTERNAL_API_BASE_URL:-http://backend:8000}
      PUBLIC_API_PORT: ${PUBLIC_API_PORT:-8000}
      PUBLIC_MIX_CALCULATOR_SESSION_HISTORY: ${PUBLIC_MIX_CALCULATOR_SESSION_HISTORY:-false}
      PUBLIC_MIX_CALCULATOR_SESSION_SAVE: ${PUBLIC_MIX_CALCULATOR_SESSION_SAVE:-false}
    depends_on:
      backend:
        condition: service_healthy

  nginx:
    container_name: lean101-clients
    image: nginx:1.27-alpine
    restart: unless-stopped
    depends_on:
      frontend:
        condition: service_started
      backend:
        condition: service_healthy
    ports:
      - "${CLIENTS_APP_PORT:-8081}:80"
    volumes:
      - ./deploy/nginx/clients.lean-101.conf:/etc/nginx/conf.d/default.conf:ro

volumes:
  clients_db_data:
